CVE-2022-48483
High
Description
3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
SeverityHigh
CVSS7.5
Exploit probability—
Product3cx
PublishedMay 2, 2023
First seenMay 2, 2023
Weakness typeCWE-22Path traversal
How to fix
Update
- 3cx 3cx18.0.3.461 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 3cx 3cx | v < 18.0.3.461 | 18.0.3.461 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.